Creating and using Short Lived Credentials in GCP

create_setup_short_lived.sh

#!/bin/bash

# Sets env variable GOOGLE_CLOUD_PROJECT if not present
[[ -z "${GOOGLE_CLOUD_PROJECT}" ]] && read -p "Enter Project ID : " GOOGLE_CLOUD_PROJECT
gcloud config set project $GOOGLE_CLOUD_PROJECT

# Creating the service accounts
gcloud iam service-accounts create sa-2-high
gcloud iam service-accounts create sa-1-low

# Granting sa-1-low permission to create short lived creds for sa-2-high
gcloud iam service-accounts add-iam-policy-binding sa-2-high@$GOOGLE_CLOUD_PROJECT.iam.gserviceaccount.com --member serviceAccount:sa-1-low@$GOOGLE_CLOUD_PROJECT.iam.gserviceaccount.com --role roles/iam.serviceAccountTokenCreator

# Granting sa-2-high Project Viewer perissions
gcloud projects add-iam-policy-binding $GOOGLE_CLOUD_PROJECT --member serviceAccount:sa-2-high@$GOOGLE_CLOUD_PROJECT.iam.gserviceaccount.com --role roles/viewer

# Create a less harmful key for sa-1-low
gcloud iam service-accounts keys create my_harmless_key.json --iam-account sa-1-low@$GOOGLE_CLOUD_PROJECT.iam.gserviceaccount.com